ci: pin Go caches to home dirs, abuild cleans srcdir

Build #256 failed in cache_save: abuild's default.conf redirects
GOMODCACHE/GOCACHE into $srcdir and wipes it after packaging, so the
restored caches were discarded and ~/go/pkg/mod never existed. Both
defaults use ${VAR:-...}, so exporting home-dir paths via ~/.buildenv
before abuild keeps the caches where cache_save expects them.

ci: cache Go module and build dirs via cacher

Restore ~/go/pkg/mod and ~/.cache/go-build from the Garage docker-cache
bucket before abuild and seed them back after, both keyed by go.sum via
the cacher helper (go.bigb.es/cacher), bootstrapped the same way as in
the bencher and ci-cacher builds. The dolt dependency tree dominates the
2m30s build step; a warm cache should cut it to well under a minute.

ci(apk): commit the build, packaging and mirror-trigger files

These three were written but never committed, so the whole publishing chain
was dead from its first link: with no .build.yml on sourcecraft there is none
on the git.srht.bigb.es mirror either, so the push hook has no manifest to
submit, no build ever ran, and dolt.sr.ht has never appeared in the apk index
at repo.bigb.es — which today holds spec.sr.ht alone.

The code itself was mirroring fine, which is what made this hard to see: the
sourcehut side sits on the current commit, so everything looks configured
until you ask git which of these files it actually knows about.

.sourcecraft/webhooks.yaml is in the same state and has the same consequence
one level up: the gitsync webhook was never registered, so the mirror has been
riding its hourly safety-net poll rather than updating on push.

The build secret apk-ci-s3 the publish task needs now exists on the account,
so nothing else blocks the first build.